[P5-1] Governance vote binds to the authenticated wallet, not a body field

A vote must be attributed to the wallet the security middleware authenticated
for the request. _handle_governance_vote trusted a spoofable body voter;
now the authenticated identity (current_request_security().wallet) always wins,
so a mismatched body voter is simply ignored (the vote records under the real
wallet). The body voter is a testnet/dev fallback only; neither present -> honest
400. No new hard block (OBSERVE posture unchanged). 3 tests.

Author: Neo

docs/ROUTES.md

@@ -63,7 +63,7 @@
 | POST | `/api/v1/governance/snapshot/vote` | `_handle_snapshot_vote` | service_routes.py:350 |  |
 | POST | `/api/v1/governance/treasury/transfer` | `_handle_treasury_transfer` | service_routes.py:351 |  |
 | POST | `/api/v1/governance/vote` | `_handle_governance_vote` | service_routes.py:227 |  |
-| POST | `/api/v1/groups` | `_handle_groups_create` | service_routes.py:1969 |  |
+| POST | `/api/v1/groups` | `_handle_groups_create` | service_routes.py:1984 |  |
 | POST | `/api/v1/iap/asn` | `handle_iap_asn` | server.py:2056 | ✅ |
 | POST | `/api/v1/iap/verify` | `handle_iap_verify` | server.py:2055 | ✅ |
 | POST | `/api/v1/identity/create` | `_handle_did_create` | service_routes.py:201 |  |
@@ -83,14 +83,14 @@
 | POST | `/api/v1/legal/agreement/execute` | `_handle_agreement_execute` | service_routes.py:365 |  |
 | POST | `/api/v1/legal/dispute/file` | `_handle_legal_dispute_file` | service_routes.py:366 |  |
 | POST | `/api/v1/legal/license/grant` | `_handle_license_grant` | service_routes.py:364 |  |
-| POST | `/api/v1/licensing/ip` | `_handle_licensing_register_ip` | service_routes.py:1973 |  |
-| POST | `/api/v1/licensing/licenses` | `_handle_licensing_create_license` | service_routes.py:1975 |  |
+| POST | `/api/v1/licensing/ip` | `_handle_licensing_register_ip` | service_routes.py:1988 |  |
+| POST | `/api/v1/licensing/licenses` | `_handle_licensing_create_license` | service_routes.py:1990 |  |
 | POST | `/api/v1/loyalty/earn` | `_handle_loyalty_earn` | service_routes.py:246 |  |
 | POST | `/api/v1/loyalty/redeem` | `_handle_loyalty_redeem` | service_routes.py:247 |  |
 | POST | `/api/v1/marketplace/buy` | `_handle_marketplace_buy` | service_routes.py:223 |  |
 | POST | `/api/v1/marketplace/list` | `_handle_marketplace_list` | service_routes.py:222 |  |
-| GET | `/api/v1/messaging/conversations` | `_handle_messaging_conversations` | service_routes.py:1959 |  |
-| GET | `/api/v1/messaging/conversations/{conversationId}/messages` | `_handle_messaging_messages` | service_routes.py:1960 |  |
+| GET | `/api/v1/messaging/conversations` | `_handle_messaging_conversations` | service_routes.py:1974 |  |
+| GET | `/api/v1/messaging/conversations/{conversationId}/messages` | `_handle_messaging_messages` | service_routes.py:1975 |  |
 | POST | `/api/v1/nft/batch-mint` | `_handle_nft_batch_mint` | service_routes.py:303 |  |
 | POST | `/api/v1/nft/bridge` | `_handle_nft_bridge` | service_routes.py:305 |  |
 | POST | `/api/v1/nft/collection/create` | `_handle_nft_collection_create` | service_routes.py:195 |  |

gateway/service_routes.py

@@ -1112,13 +1112,28 @@ async def _handle_governance_create(self, request: web.Request) -> web.Response:
 
     async def _handle_governance_vote(self, request: web.Request) -> web.Response:
         body = await self._parse_body(request)
-        self._require(body, "proposal_id", "voter", "support")
+        self._require(body, "proposal_id", "support")
+        # P5-1: bind the vote to the wallet the security middleware authenticated
+        # for THIS request — not a spoofable body field. An authenticated identity
+        # always wins, so a mismatched body ``voter`` is simply ignored (the vote
+        # is recorded under the real wallet). The body voter is a testnet/dev
+        # fallback only, used when no identity was bound. The 400 for a
+        # fully-absent voter just mirrors the prior _require("voter") — no gate
+        # stricter than before, and the Morpheus OBSERVE gate itself is untouched.
+        from gateway.security_gate import current_request_security
+        authed = str((current_request_security() or {}).get("wallet") or "")
+        voter = authed or str(body.get("voter") or "")
+        if not voter:
+            raise web.HTTPBadRequest(
+                text=json.dumps({"error": "voter identity required"}),
+                content_type="application/json",
+            )
         # governance.vote's parameter is `choice`, not `support` — passing
         # support= raised TypeError (500) on every live vote. Map it here.
         result = await self._call(
             "governance", "vote",
             proposal_id=body["proposal_id"],
-            voter=body["voter"],
+            voter=voter,
             choice=body["support"],
         )
         return self._ok(result)

tests/test_p5_identity.py

@@ -0,0 +1,75 @@
+"""P5-1 regression tests: governance vote binds to the authenticated wallet.
+
+A vote must be attributed to the wallet the security middleware authenticated
+for the request — not a spoofable ``voter`` body field. When an identity is
+bound, it wins over the body; with no identity the body voter is a testnet/dev
+fallback; with neither, the request is an honest 400.
+"""
+
+import pytest
+from aiohttp import web
+from aiohttp.test_utils import TestClient, TestServer
+
+from gateway.service_routes import ServiceRoutes
+from gateway.security_gate import bind_request_security
+
+
+@pytest.fixture
+async def env():
+    routes = ServiceRoutes(config={})
+    app = web.Application()
+
+    @web.middleware
+    async def _bind_wallet(request, handler):
+        w = request.headers.get("X-Test-Wallet")
+        if w:
+            bind_request_security(identity=w)
+        return await handler(request)
+
+    app.middlewares.append(_bind_wallet)
+    routes.register_routes(app)
+    async with TestClient(TestServer(app)) as c:
+        yield routes, c
+
+
+def _spy_vote(routes, captured):
+    async def spy(service, method, **kwargs):
+        if method == "vote":
+            captured.update(kwargs)
+        return {"status": "cast", **kwargs}
+    routes._call = spy  # type: ignore[assignment]
+
+
+async def test_authenticated_wallet_wins_over_body_voter(env):
+    routes, client = env
+    captured: dict = {}
+    _spy_vote(routes, captured)
+    resp = await client.post(
+        "/api/v1/governance/vote",
+        headers={"X-Test-Wallet": "0xAUTH"},
+        json={"proposal_id": "p1", "voter": "0xSPOOF", "support": "yes"},
+    )
+    assert resp.status == 200, await resp.text()
+    assert captured.get("voter") == "0xAUTH", "the authenticated wallet must win, not the body voter"
+
+
+async def test_body_voter_used_when_unauthenticated(env):
+    routes, client = env
+    captured: dict = {}
+    _spy_vote(routes, captured)
+    resp = await client.post(
+        "/api/v1/governance/vote",
+        json={"proposal_id": "p1", "voter": "0xbob", "support": "yes"},
+    )
+    assert resp.status == 200, await resp.text()
+    assert captured.get("voter") == "0xbob", "the body voter is the testnet fallback"
+
+
+async def test_no_identity_at_all_is_honest_400(env):
+    routes, client = env
+    resp = await client.post(
+        "/api/v1/governance/vote",
+        json={"proposal_id": "p1", "support": "yes"},
+    )
+    assert resp.status == 400, await resp.text()
+    assert "voter" in (await resp.json()).get("error", "").lower()